As far as I can recall, here is a quick illustration.
Code:
ssh -l user my.host -L local_port:localhost:blocked_port
Once logged in, the port "local_port" will be listening on your local host. You must leave this SSH session open throughout. By now, traffic to "local_port" at localhost will be routed to the "blocked_port" at "my.host" instead (until the SSH session is torn down).
This is good for exposing a few blocked ports without all the hassle of setting up VPN. And apart from exposing blocked ports on the SSH'ed host itself you can even bridge to a port at an internal host behind NAT.
